PT-2025-53402 · Aidango · Aidango

Berat Arslan · Publicado 2025-12-25 · Atualizado 2026-01-19 · CVE-2025-2307

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Aidango versions prior to 2.144.4

Description Aidango is susceptible to a Cross-Site Scripting (XSS) issue due to improper neutralization of input during web page generation. XSS occurs when an application includes malicious code in a web page viewed by other users. This can allow attackers to execute scripts in the context of a user's browser, potentially leading to session hijacking or defacement of the website. The vulnerability exists because the application does not properly sanitize user-supplied input before including it in the generated web pages. This allows an attacker to inject malicious scripts into the web page, which will then be executed by other users who view the page.

Recommendations Update Aidango to version 2.144.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-2307

Produtos afetados

Aidango

Referências · 11

• https://twitter.com/TheHackerWire/status/2004332823327686805 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2004332962838610234 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2004338558845571457 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-2307 · Nota de Segurança
• https://t.me/CVEtracker/40660 · Publicação no Telegram
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0487 · Nota
• https://twitter.com/DavidMarquet19/status/2013159711831372185 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2004294848912732263 · Publicação no Twitter
• https://t.me/cveNotify/146825 · Publicação no Telegram
• https://usom.gov.tr/bildirim/tr-25-0487 · Nota
• https://twitter.com/RedPacketSec/status/2004208584096169989 · Publicação no Twitter